Graylog2 / Graylog2/graylog2-server

Remove filter on the _index field in the org.graylog2.plugin.Message class

Open
#4,435 2 comments 0 reactions 0 assignees View on GitHub
bug triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

With the current setup that the `org.graylog2.plugin.Message` class has, it's not possible to produce output that contains the `_index` field. This doesn't allow us to construct a permalink to the message, [which we want to push as a Slack alert](https://github.com/graylog-labs/graylog-plugin-slack/blob/f27f642e84db2c2c6a34ad19023d72d36ed3d65e/src/main/java/org/graylog2/plugins/slack/output/SlackMessageOutput.java#L92).

I do not know what's the reason behind filtering out this field in the `plugins` package.

## Expected Behavior

We should be allowed to use the `_index` value that a message has in the plugin package.

## Current Behavior

It's not possible to get the `_index` field from the Message object, because it's filtered out.

References:
https://github.com/Graylog2/graylog2-server/blob/master/graylog2-server/src/main/java/org/graylog2/plugin/Message.java#L101
https://github.com/Graylog2/graylog2-server/blob/master/graylog2-server/src/main/java/org/graylog2/plugin/Message.java#L357

## Possible Solution

Put the `_index` key in the `RESERVED_SETTABLE_FIELDS` const.

## Steps to Reproduce (for bugs)

1. Install https://github.com/graylog-labs/graylog-plugin-slack
2. Setup an alert to use Slack as alerting medium
3. Loop through the messages in the alert, and output them `${foreach backlog message} ${message} ${end}`
4. Observe there is no `index` or `_index` field that you can use to construct the URL.

## Context

Building a permalink to a message that pops up in Slack alert, so we can easily click on it and see the full message in Graylog. Currently we rely on `graylog_deflector` in the URL to point us to the message, but this doesn't work once the deflector changes index.

## Your Environment

* Graylog Version: 2.6
* Elasticsearch Version:
* MongoDB Version: 3.0
* Operating System: Arch Linux
* Browser version: Firefox 58

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.